Integration of and Third-Generation Wireless Data Networks

Transcription

1 Integration of and Third-Generation Wireless Data Networks Milind M. Buddhikot Center for Networking Research Lucent Bell Labs Research

2 Outline Current Trends and Rationale for Integration Integration of and 3G Integration approaches Tight Loose A Prototype Implementation IOTA Gateway Multi-interface client Measurements Conclusions Slide 2

3 Evolving Picture 3G1X, 3G1XEVDO, UMTS, a/b access operated by different providers Customers with multi-radio capable end devices Multitudes of applications, seamless roaming, preserve sessions, single bill Wireless Access Networks Wi-Fi Access of A Wi-Fi Access of B 2.5G/3G Access of C Subscriber Service One bill from One provider (3G carrier?) Roaming or even Seamless Handoff in Multiple Networks Uninterrupted Applications: Streaming, , Corporate VPN, Web Terminal Possibilities Wi-Fi card Slide 33G card Laptop 3G card Laptop with Laptop with Built-in Wi-Fi & 3G Built-in Wi-Fi PDA w/ Wi-If & 3G

4 Wireless Access Networks Evolving Picture Seamless roaming: Efficient authentication inter and intra-tech handoffs via Interoperation of mobility mechanisms Wi-Fi Access of A Billing info across access networks and providers Uniform service mapping Roaming Agreements! Wi-Fi Access of B 2.5G/3G Access of C Handoff Possibilities Intratech Internetwk Handoff Intertech Internetwk Handoff Subscriber Service One bill from One provider (3G carrier?) Roaming or even Seamless Handoff in Multiple Networks Uninterrupted Applications: Streaming, , Corporate VPN, Web Terminal Possibilities Wi-Fi card Slide 43G card Laptop 3G card Laptop with Laptop with Built-in Wi-Fi & 3G Built-in Wi-Fi PDA w/ Wi-Fi & 3G

5 Complete Picture Wireless ISP A Roaming agreement Wireless ISP B Roaming agreement Cellular Carrier C Network Owners Internet VPN Corporate Network D Wireless Access Networks Wi-Fi Access of A Wi-Fi Access of B 2.5G/3G Access of C Handoff Possibilities Intratech Internetwk Handoff Intertech Internetwk Handoff Subscriber Service One bill from One provider (3G carrier?) Roaming or even Seamless Handoff in Multiple Networks Uninterrupted Applications: Streaming, , Corporate VPN, Web Terminal Possibilities Wi-Fi card Slide 53G card Laptop 3G card Laptop with Laptop Infocom with 2003 (Milind Buddhikot) Built-in Wi-Fi & 3G Built-in Wi-Fi PDA w/ Wi-Fi & 3G

6 Integration Architectures -Tight and Loose

7 802.11b Network Encrypted MN AP Router MN MN To Internet Infrastructure mode: MN MN: Mobile Node STA: Station AP: Access Point AP STA MNs communicate via base stations Access Points (AP) AP s together with Ethernet characterized by ESSID Mbps, Range limited m MN MN-AP communication encrypted using WEP Encryption keys may be established Statically Dynamically using 802.1x With TKIP Layer-2 mobility via inter-ap protocols Slide 7

8 Representative 3G Network: CDMA2000 1X- RTT Radio Access Network Base Station F-AAA Internet Web server H-AAA HA Base Station 144 Kbps per carrier MN maintains RNC Radio Link Protocol Point-to-Point Protocol RLP connection to RNC PPP connection to PDSN PCF PDSN MSC/ VLR HLR VLR F-AAA H-AAA HA FA PDSN PCF RNC SS7 Network HLR : Home Location Register : Visited Location Register : Foreign AAA : Home AAA : Home Agent : Foreign Agent : Packet Data Serving Node : Packet Control Function : Radio Network Control PDSN supports Mobile-IP and Simple-IP mode FA functions in MIP mode Slide 8

9 Basic Ideas for Integration Option I Gateway Access Points Both integration approaches use a new network element called Gateway Deployed in the network o Option II Gateway o o Observations: Multiple access points connect to the gateway Option I: A gateway per subnet, each with multiple AP s Option II: One gateway per routed network with multiple subnets Can perform layer-2, 3, 4, 7 packet processing Functionality, protocol support depends on the integration approach Slide 9

10 Tight Integration Billing Servers Home network (3G carrier) Local AAA Home AAA GGSN/ PDSN 3G Core Network Internet gateway uplink connects to the to 3G core network Connect to GGSN in UMTS or PDSN in 3GPP2 3G Wireless Access BS SGSN Or PCF RNC WISP 1: Tight integration Access Gateway Uplink is ATM over T1, T3, or SONET Ethernet, POS with IP Release 6 of UMTS. Gateway appears as a new SGSN or PCF BS Access Points jk Slide 10

11 Tight Integration (contd.) Goal: Use the 3G protocol stack on the MN to sign on and use networks RADIO is yet another 3G radio Advantages: Requires minimal changes to the client (in theory) Use same authentication infrastructure and profile Easy to generate one common billing statement Easy to view network from the network management point Disadvantages far outweigh the above Slide 11

12 Disadvantages of Tight Integration Traffic engineering: Wide area cellular core networks carefully engineered to handle (peak) traffic from base stations Since, traffic to the internet flows over the 3G core network, traffic load increased by ~25 to 100 times Core network must be re-engineered else QoS for regular 3G traffic severely affected Authentication overhead Use of 3G authentication scheme requires gateway interface to a VLR or implement VLR functions Ciphering, Integrity keys in 3G may not be usable in a encryption procedure Split implementation complicates gateway MN to Gateway protocol: EAP over RADIUS Gateway to VLR/HLR: 3G protocol Slide 12

13 Client overheads for Tight Integration Client software must include 3G stack even for only users Use SIM Card on network Must use appropriate 802.1x signaling packets to transport 3G specific signaling traffic Involves client changes, definition of new EAP types 3G software not usable transparently Additional glue software required to hide and 802.1x specific differences from 3G software Slide 13

14 Provider Nightmare infrastructure must be owned by 3G provider 3G provider burdened with rollout of 3G and ! Else, if network operated by other provider Alternate internet uplink for non-3g roaming customers If provider wants roaming agreement with multiple 3G providers it must have at least one uplink per provider! Provider cores are non-overlapping Wireless carrier cannot benefit from Wireless ISP deployments networks not deployed independently of GPRS/UMTS Gateway complicated for co-existing non-3g and 3G-roaming customers QoS mapping from UMTS to e for roaming 3G customers SS7 awareness for authentication Slide 14

15 Loose Integration Architecture Billing Servers Home network (3G carrier) Local AAA 3G Wireless Access BS Home AAA PDSN or GGSN PCF or SGSN 3G Core Network RNC BS WISP 1: Loose integration Access Internet Gateway Access Points gateway connected to the internet via uplink Option I or II mode Layer-2 or layer-3 connection No direct connectivity to 3G core network Loose: Data paths for two networks completely separated network can be owned by different provider Roaming contract with 3G provider Slide 15

16 Loose Integration provider authenticates the 3G roaming customer using 3G credentials Roaming agreement with 3G provider which allows authentication traffic to be directed to 3G AAA/HLR 3G provider may have to support new authentntication schemes as a part of roaming agreement E.g.: SKE, TLS, SRP /802.1x keys can be derived as an outcome of authentication protocol Billing records generated by the gateway shipped to 3G HLR/H-AAA Revenue settlement at a later date Slide 16

17 Loosely Coupled Integration with CDMA2000 To VLR/MSC 3G Wireless Access SS7 Network PCF BS Billing Servers HLR PDSN BSC Home AAA MobileIP FA FAAA PPP Termination BS Home Agent Internet 3G Provider Home Network Hot-spot Access Router Gateway Access Points Integration possible without changing 3GPP2 standards Integration based on MobileIP and AAA/RADIUS protocols Same Layer 3 Authentication on both and CDMA2000 Networks Normal Layer 2 authentication to HLR on CDMA2000 network Slide 17

18 IOTA: A Prototype Implementation

19 The IOTA prototype IOTA=Integration Of Two Access technologies b and 1XRTT, 1XEV-DO networks Research prototype that implements the looselycoupled architecture Highly modularized IOTA gateway Runs on off-shelf hardware (single/dual processor 750 MHz, Linux OS) Multi-interface mobility client software, Management of mobility across multiple network interfaces and multiple wireless/wireline technologies Slide 19

20 Software architecture of the IOTA gateway IP components Active Session State Database IPF Web Cache MIP Foreign Agent DHCP Server Web Server QoS Module Web Services Local Portal Mobility management MIP Home Agent IP Forwarding Packet-Mangle QoS Firewall NAT Uplink Interface IPC Service Authentication and Accounting Accounting Daemon RADIUS Server/Proxy Downlink Interface User space Kernel space Datapath Slide 20

21 Software architecture of the IOTA gateway Active Session State Database IPC Service IPF DHCP Server IP components QoS Module Web Services Web Web Local Cache Server Portal IP Forwarding Packet-Mangle The IOTA Packet Filter (IPF) is a high-performance Mobility management QoS implementation of a dynamic stateful firewall with Firewall Source and Destination MIP Foreign NAT capabilities. MIP Home It builds on top NAT of the Linux IPTABLES Agentarchitecture. Agent The authentication modules of IOTA use the IPF interface to dynamically admit clients for service, Authentication and to implement and Accounting per-client security policies. The firewall rules it installs include matching the MAC address Accounting of the clients, so that RADIUS IP spoofing attacks become difficult to Daemon perpetrate. Server/Proxy The packet-mangling rules are used to automatically redirect user s traffic to IOTA services such as the web cache and the DNS server. User space Kernel space Uplink Interface Downlink Interface Slide 21

22 Software architecture of the IOTA gateway Active Session State Database IPC Service IPF Web Cache DHCP Server Web Server IP components QoS Module Web Services Local Portal IP Forwarding Packet-Mangle QoS Firewall NAT Mobility The DHCP management Server allows access to Simple-IP MIP Foreign clients. MIP Home It drives IPF to transparently Agent redirect Agent unauthenticated clients to the local web server (over SSL) so that they can Authentication perform and Accounting password authentication. After authentication, the web server informs the Accounting DHCP server RADIUS so that it can install per-client Daemon security Server/Proxy policies. It can also be configured in DHCP relay mode. Uplink Interface Downlink Interface User space Kernel space Slide 22

23 QoS Features for Need QoS functionality in two spots of possible congestion IP QoS on oversubscribed access link QoS for air interface e defining layer-2 QoS on the air-interface Layer-7/4/3 mechanisms for IP level QoS mechanisms complement e 10 Mbps Home AAA Edge Router Access Router Internet Home Agent Gateway 10 Mbps 10 Mbps Gold Service User Silver Service User IP QoS on access bottleneck QoS over air Bronze Service User Slide 23

24 QoS for Per user service level policy obtained from Home AAA database in AAA protocol exchange Three service classes (Gold, Silver, Bronze) Minimum rate guarantees per class (750 Kbps, 500 Kbps, Best-effort) Map user population in cells to achieve fairness and preserving service level guarantees SNMP queries to APs DiffServ packet marking and traffic policing Gateway can mark packets even with Mobile IP tunnels Home agent marks packets for destined traffic Additional enhancements possible with client QoS software Slide 24

25 Software architecture of the IOTA gateway Active Session State Database IPC Service IPF Web Cache DHCP Server Web Server IP components QoS Module Web Services Local Portal Mobility management IP Forwarding Packet-Mangle QoS Firewall NAT MIP Foreign MIP Home Agent Agent The Web Cache is a proprietary, highperformance Accounting caching web-proxy. It is Authentication and especially useful with the Mobile-IP service. Accounting RADIUS Daemon Server/Proxy Uplink Interface Downlink Interface User space Kernel space Slide 25

26 Benefits of Integrated Web Cache reduces congestion on access lines to network provides performance optimization for web traffic by not routing packets back to Mobile IP home agent from cache; can only be done if cache is integrated with foreign agent in same box Home AAA Home Agent Home AAA Home Agent Edge Router Internet 4 Web Site 3 2 Edge Router Internet 3 Web Site Access Router w/ Foreign Agent L4 switch Web Cache Access Router 2 5 Web response 1 Web request Integrated small-scale web cache Gateway 10 Mbps 4 1 Slide 26

27 Software architecture of the IOTA gateway Active Session State Database IPC Service IPF Web Cache MIP Foreign Agent DHCP Server Web Server IP components QoS Module Web Services Local Portal Mobility management MIP Home Agent Authentication and Accounting The Web Server Accounting is used for Simple-IP RADIUS authentication, and Daemon as a Local Portal. Server/Proxy IP Forwarding Packet-Mangle QoS Firewall NAT Uplink Interface Downlink Interface User space Kernel space Slide 27

28 Software architecture The MIP of Foreign the Agent IOTA is used to gateway handle Active Session State Database IPC Service IPF Web Cache MIP Foreign Agent Accounting Daemon Mobile-IP clients. Like the DHCP server, it interfaces with the local RADIUS server to IP components download per-client service, QoS and DHCP security policies QoS from the H-AAA, and Serverinterfaces Modulewith the QoS, IPF and Accounting modules to enforce them. Web Services Web Server Local Portal Mobility management MIP Home Agent Authentication and Accounting RADIUS Server/Proxy IP Forwarding Packet-Mangle QoS Firewall NAT Uplink Interface Downlink Interface User space Kernel space Slide 28

29 IOTA Accounting Provide accounting mechanism but no pricing policy Application 1 libacct Accounting Table 3 4 AcctD 5 Accounting events generated by applications e.g: DHCP, MIP agent Application compile libacct Accounting Start and End events DHCP address allocated (released) MIP registration successful or failed 2 Session Table Accounting Packets Web authentication succeeds Collect:start and stop times, duration, packet and octet counts, IP addr etc Acctd xfers records to accounting server (e.g.: RADIUS accounting) Slide 29

30 IOTA Client

31 IOTA Client - Features Supports mobility across several kinds of physical interfaces List of physical interfaces configured with associated priorities Seamless : A user process doesn t see any change in its connections. Selection of the interface to use dependent on the user preference, signal strength, availability of a mobility agent in the network. Bounce protection algorithm that minimizes the switching between the interfaces, between access points on the same interface Allow IPSec tunneling independent of mobility. Slide 31

32 IOTA client architecture Client GUI Multi-interface Mobility Client IPSec Client Driver API TCP/IP Stack IPSec Client Driver Multi-interface mobility driver User space Kernel space Ethernet driver driver PPP driver 3G-1x driver Slide 32

33 IOTA client architecture Client GUI Multi-interface Mobility Client IPSec Client User space Driver API TCP/IP Stack The GUI is of course the glue that IPSec links Client together Driver the various parts of the client, and allow them to interface Multi-interface mobility with driver the user. Here is the actual example Ethernet PPP 3G-1x driver driver driver driver Kernel space Slide 33

34 Client GUI A simple and effective GUI that reports the most current status of the networks and the mobility manager. It also allows users to edit the configuration information. Slide 34

35 IOTA client architecture Client GUI Multi-interface The Mobility Client Service IPSec is the Client heart Mobility Client of the system. It detects the status and availability of the network interfaces. For example, it tracks the signal strength of the interface, and decides when it Driver API TCP/IP is time Stack to switch to or from it. It needs to implement an intelligence bouncepreventing Driver mechanism, as to avoid IPSec Client inefficiencies caused by frequent Multi-interface mobility handovers driver due to the proximity of several radio networks. It also implements the Ethernet PPP Mobile IP 3G-1x protocol, for seamless roaming driver driver driver driver across different subnets. User space Kernel space Slide 35

36 IOTA client architecture The Mobility Driver handles the IP packets in and out of the system, just before/after they reach the various interfaces. Managed by the Mobility Client Service, it routes the packets to the correct interface. It also handles the decapsulation and encapsulation of the packets when the client operates in Mobile IP co-located FA mode. Note the location of the driver, just below the IPSec driver. This is actually a critical Client issue, GUI since IPSec (and, in general, security drivers) tend to take over the TCP/IP stack. It is Multi-interface therefore important to be able to operate right after they IPSec Client Mobility Client have handled the packets, so as to be able to route it appropriately. Driver API TCP/IP Stack IPSec Client Driver User space Kernel space Multi-interface mobility driver Ethernet driver driver PPP driver 3G-1x driver Slide 36

37 Interface Selection Want to elect the best interface Best signal quality Best bandwidth Highest priority (assigned by user) Conflicting requirements : often, priority and signal quality Impossible to measure precise dynamic bandwidth; we assume priority can be assigned according to the static bandwidth. Want to avoid frequent switching between interfaces Slide 37

38 Interface Selection (contd.) Our design: Each interface is assigned a priority Switch to a new interface if it has a higher priority than that of the current one Signal strength is measured periodically Switch to a new interface if the new one has signal strength twice that of the current one. Normalized signal strength is divided into three segments, using two thresholds (high and low) to avoid bouncing, switch to an interface only when its signal exceeds a threshold, and switch out if signal strength drops a certain threshold. Compute a weight for each interface, based on its signal strength, priority, and if it is the currently chosen interface Slide 38

39 Summary Opportunity for carriers to strengthen 3G offerings with integration using IETF standards (security, accounting, mobility) in networks integration with CDMA 2000, GPRS/UMTS via loosely coupled approach Benefits of simplicity, network efficiency, cost ability to partner with Wireless ISPs Can be extended to support Location services Network based VPNs Slide 39

40 Backup

41 Example Integrated 3G/ Service John Doe, has a laptop/handheld with a 3G and an interface. John Doe likes service that many airports offer because of the high bandwidth he could enjoy offers only spot coverage Need to sign-up with many providers to receive service in the places he most visits. manually setup and tear-down his wireless connection as he travels from one place to the other. John is therefore attracted by the ubiquitous coverage of 3G networks John signs with a 3G carrier, which, in turn, has roaming agreements with many service providers. Slide 41

42 Example Integrated 3G/ Service Service provider offers following service options A: $99: Unlimited 3G service (e.g. Verizon Express) B: $125: Unlimited 3G roaming John selects B. John travels an airport concourse with service, his machine transparently switches to the access. When John leaves the coverage of the provider, his machine should seamlessly switch to the 3G access. John pays a fixed bill to 3G provider 3G provider and provider share revenue Slide 42

43 Integrating and 3G: Service Provider Wish List Carrier differentiation Wider data coverage without deploying networks Potentially better performance and QoS for data in congested hotspot and indoor areas Better 3G voice Subscriber Ownership and growth Offer hot spot access to a 3G subscriber as a value add example: 20/month for 3G, 25/month package for 2.5G/3G data access on all roaming partner networks Volume subscribers (by millions) for operators Transparent handoff and roaming Customers with dual radio modem transparently handoff from a 3G to a network Roaming agreement between 3G operator and operator Slide 43

44 Provider Wish List (Goals) contd. Use common AAA and billing infrastructure for integrated access Single point for subscribe management and billing Avoid creating duplicate and disparate authentication mechanisms Use of one common efficient mechanism How to achieve this? Slide 44

45 Provider Wish List (Goals) contd. Use common AAA and billing infrastructure for integrated access Single point for subscribe management and billing Avoid creating duplicate and disparate authentication mechanisms Use of one common efficient mechanism How to achieve this? Slide 45

46 Software architecture of the IOTA gateway Active Session State Database IPC Service IPF Web Cache MIP Foreign Agent DHCP Server IP components QoS Module Web Services Web The RADIUS Local server serves as the Server authentication Portalcore of the IP system Forwarding Packet-Mangle Mobility management QoS Firewall MIP Home NAT Agent Authentication and Accounting Accounting Daemon RADIUS Server/Proxy Uplink Interface Downlink Interface User space Kernel space Slide 46

47 IOTA RADIUS Used in two modes Local first-tier proxy Standalone local AAA server In proxy mode: RADIUS exchanges of auth traffic on behalf of (MIP FA, DHCP, Web server, etc.) with clients home AAA servers. Download per-client policies such as the QoS level to which each client is entitled to, etc. Performs Authentication, Generates Encryption and Authentication keys Radius exchange 802.1X exchange over air Home Network Home AAA Internet Home Agent IOTA RADIUS Algorithm to construct encryption key from passed Master Key Slide 47

48 Portable Simple IP Solution First phase: Common Billing & Authentication support No roaming support and cross network handoff Defined as Simple IP in CDMA2000 standards Common AAA support for & CDMA2000 Use same authentication credentials on both networks Slide 48

49 Seamless Mobility solution Second phase: Maintain data session across networks and service providers Adds full MobileIP support and cross network handoff Since CDMA2000 uses MobileIP, obvious solution is to support MobileIP functions in the gateway Slide 49

50 Software architecture of the IOTA gateway Active Session State Database IPC Service IPF Web Cache DHCP Server Web Server IP components QoS Module Web Services Local Portal IP Forwarding Packet-Mangle QoS Firewall NAT Mobility management The Session Database allows the system to MIP Foreign keep persistent MIP Home state about the connected Agent clients, even Agent in case of system crash Authentication and Accounting Accounting Daemon RADIUS Server/Proxy Uplink Interface Downlink Interface User space Kernel space Slide 50

51 Session Database Implemented as a in-memory SQL database Backed up on the secondary storage (Crash recovery) IOTA modules refer to session state in the database Session states: UnAuthenticated, Authenticated- TrafficBlocked, Authenticated-Traffic-Passed Accounting records Session profile: Traffic class, Minimum Rate Guarantees, preferred authentication method, NAI, SimpleIP/MobileIP mode, Home Address etc. Slide 51

52 Software architecture of the IOTA gateway Active Session State Database IPC Service IPF DHCP Server IP components QoS Module Web Services Web The Inter-Process Web Communication Local library is Cache Server Portal IP Forwarding a light-weight system that allows near-realtime communication between the different Packet-Mangle Mobility management QoS modules of the system Firewall MIP Foreign MIP Home NAT Agent Agent Authentication and Accounting Accounting Daemon RADIUS Server/Proxy Uplink Interface Downlink Interface User space Kernel space Slide 52

53 IOTA Client Licensing IOTA Client Software for multi-interface integration is currently under consideration for licensing with a few vendors It is available for licensing with appropriate agreements Please talk to Milind M. Buddhikot (mbuddhikot@dnrc.bell-labs.com) Slide 53

54 Software architecture of the IOTA gateway Active Session State Database IPC Service IPF Web Cache DHCP Server Web Server IP components QoS Module Web Services Local Portal IP Forwarding Packet-Mangle QoS Firewall NAT The Mobility QOS Module management is driven by policies that MIP Foreign are installed MIP in Home the database during the Agent authentication Agent procedure. In turn, it drives a proprietary QoS packet shaper/scheduler Authentication in the Linux and Accounting kernel. The end result is support of bi-directional, per-user QoS Accounting levels that RADIUS are effective at layer-3 Daemon independently Server/Proxy from the availability of linklayer mechanisms. Uplink Interface Downlink Interface User space Kernel space Slide 54

55 Web based authentication Password can be One-Time- Password (OTP), SecureID, Biometric Devices Traffic blocked until authentication succeeds Slide 55

56 Software architecture of the IOTA gateway Active Session State Database IPC Service IPF Web Cache MIP Foreign Agent Accounting Daemon The Accounting Daemon is called by the different IP authentication components and access entities of the system (RADIUS server, MIP FA and DHCP DHCP QoS server) to trigger the start and stop of the Server Module accounting operations. The accounting data of each client is kept in the persistent state database, Web so Services as not to loose important accounting Web data Local even in case of system Server Portal reboots. Mobility management MIP Home Agent Authentication and Accounting RADIUS Server/Proxy IP Forwarding Packet-Mangle QoS Firewall NAT Uplink Interface Downlink Interface User space Kernel space Slide 56

57 Client Design Goals Support for multiple kinds of physical interfaces Modular enough to be able to add a new kind of physical interface Support for mobile IP, to provide seamless mobility Support for third party IPSec over mobile IP Slide 57

58 Calculation of Signal Strength Interface selection is based on the weight calculated from priority and signal strength Signal strength is measured periodically Each individual sample of signal strength can be fluctuating a lot due to environmental changes (such as people moving about) We have a few mechanisms to track a stable signal strength Averaging n samples of signal strength measurements Dropping the zero value between two high non-zero values Calculating the slope of the measured signal strength (based on past two values) and predicting a trend for the next interval Slide 58